Skip to content

Commit 8c503eb

Browse files
MichaelEakinsMichaelEakins
committed
feat: migrate to npm Trusted Publishing with comprehensive security infrastructure
BREAKING CHANGES: - Release workflow now tag-based (no auto-bump on push to main) - Use 'git tag vX.Y.Z && git push origin vX.Y.Z' to trigger releases Security Infrastructure: - npm Trusted Publishing (OIDC) - no tokens required - Cryptographic provenance via Sigstore - Automated security audits (weekly) - Dependabot dependency updates - CodeQL code scanning - React 18 & 19 compatibility testing Workflows Added: - .github/workflows/release.yml - Tag-based releases with OIDC - .github/workflows/security-audit.yml - npm audit + CodeQL - .github/workflows/react-compat.yml - React version matrix - .github/dependabot.yml - Automated dependency updates Documentation: - SECURITY.md - Vulnerability reporting policy - Updated README with security badges - Updated CHANGELOG for v1.0.4 Deprecated: - .github/workflows/publish.yml - Replaced by release.yml Refs: #security #trusted-publishing #oidc
1 parent 98bbe77 commit 8c503eb

8 files changed

Lines changed: 354 additions & 2 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "09:00"
9+
open-pull-requests-limit: 10
10+
groups:
11+
# Group all production dependencies
12+
production-dependencies:
13+
applies-to: version-updates
14+
dependency-type: "production"
15+
update-types:
16+
- "minor"
17+
- "patch"
18+
19+
# Group development dependencies
20+
development-dependencies:
21+
applies-to: version-updates
22+
dependency-type: "development"
23+
update-types:
24+
- "minor"
25+
- "patch"
26+
27+
# Group testing dependencies
28+
testing-dependencies:
29+
applies-to: version-updates
30+
patterns:
31+
- "@testing-library/*"
32+
- "jest*"
33+
- "@types/jest"
34+
update-types:
35+
- "minor"
36+
- "patch"
37+
38+
# Group build tools
39+
build-tools:
40+
applies-to: version-updates
41+
patterns:
42+
- "rollup*"
43+
- "@rollup/*"
44+
- "typescript"
45+
- "vite"
46+
update-types:
47+
- "minor"
48+
- "patch"
49+
50+
# Auto-assign PRs
51+
assignees:
52+
- "MichaelEakins"
53+
54+
# Labels for PRs
55+
labels:
56+
- "dependencies"
57+
- "automated"
58+
59+
commit-message:
60+
prefix: "chore(deps)"
61+
include: "scope"
62+
63+
- package-ecosystem: "github-actions"
64+
directory: "/"
65+
schedule:
66+
interval: "weekly"
67+
day: "monday"
68+
time: "09:00"
69+
labels:
70+
- "dependencies"
71+
- "github-actions"
72+
commit-message:
73+
prefix: "chore(actions)"

.github/workflows/publish.yml renamed to .github/workflows/publish.yml.old

File renamed without changes.

‎.github/workflows/react-compat.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: React Compatibility
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
# Run weekly on Tuesdays at 9 AM UTC
10+
- cron: '0 9 * * 2'
11+
workflow_dispatch:
12+
13+
jobs:
14+
test-react-versions:
15+
name: Test React ${{ matrix.react-version }}
16+
runs-on: ubuntu-latest
17+
18+
strategy:
19+
fail-fast: false
20+
matrix:
21+
react-version: ['18', '19']
22+
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@v4
28+
with:
29+
node-version: '20'
30+
cache: 'npm'
31+
32+
- name: Install dependencies
33+
run: npm ci
34+
35+
- name: Install React ${{ matrix.react-version }}
36+
run: |
37+
npm install --save-dev react@${{ matrix.react-version }} react-dom@${{ matrix.react-version }}
38+
39+
- name: Run tests
40+
run: npm test
41+
42+
- name: Type check
43+
run: npm run type-check
44+
45+
- name: Build
46+
run: npm run build
47+
48+
- name: Update badge (React 18)
49+
if: matrix.react-version == '18' && github.ref == 'refs/heads/main'
50+
run: |
51+
echo "React 18 compatibility: ✅ Passing" >> $GITHUB_STEP_SUMMARY
52+
53+
- name: Update badge (React 19)
54+
if: matrix.react-version == '19' && github.ref == 'refs/heads/main'
55+
run: |
56+
echo "React 19 compatibility: ✅ Passing" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/release.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
# CRITICAL: Required for npm Trusted Publishing (OIDC authentication)
9+
permissions:
10+
contents: write # Needed to create GitHub releases
11+
id-token: write # Needed for npm provenance/trusted publishing
12+
13+
jobs:
14+
release:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
with:
19+
fetch-depth: 0
20+
21+
- name: Setup Node.js
22+
uses: actions/setup-node@v4
23+
with:
24+
node-version: '20'
25+
# NO registry-url - prevents .npmrc conflicts with OIDC
26+
27+
- name: Upgrade npm for Trusted Publishing
28+
run: npm install -g npm@latest # Requires npm >= 11.5.1
29+
30+
- name: Install dependencies
31+
run: npm ci
32+
33+
- name: Build
34+
run: npm run build
35+
36+
- name: Test
37+
run: npm test
38+
39+
- name: Type Check
40+
run: npm run type-check
41+
42+
- name: Publish to npm with Provenance
43+
run: npm publish --provenance --access public
44+
# OIDC authentication via GitHub Actions - no tokens needed!
45+
46+
- name: Create GitHub Release
47+
uses: softprops/action-gh-release@v2
48+
with:
49+
tag_name: ${{ github.ref }}
50+
name: Release ${{ github.ref_name }}
51+
body: |
52+
See [CHANGELOG.md](https://github.com/CrashBytes/react-version-compare/blob/main/CHANGELOG.md) for details.
53+
draft: false
54+
prerelease: false

‎.github/workflows/security-audit.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Security Audit
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
# Run weekly on Mondays at 9 AM UTC
10+
- cron: '0 9 * * 1'
11+
workflow_dispatch:
12+
13+
permissions:
14+
contents: read
15+
security-events: write
16+
pull-requests: write
17+
18+
jobs:
19+
npm-audit:
20+
name: npm audit
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
- name: Setup Node.js
26+
uses: actions/setup-node@v4
27+
with:
28+
node-version: '20'
29+
cache: 'npm'
30+
31+
- name: Install dependencies
32+
run: npm ci
33+
34+
- name: Run npm audit
35+
run: npm audit --audit-level=moderate
36+
continue-on-error: true
37+
38+
- name: Run npm audit (production only)
39+
run: npm audit --production --audit-level=moderate
40+
41+
dependency-review:
42+
name: Dependency Review
43+
runs-on: ubuntu-latest
44+
if: github.event_name == 'pull_request'
45+
steps:
46+
- uses: actions/checkout@v4
47+
48+
- name: Dependency Review
49+
uses: actions/dependency-review-action@v4
50+
with:
51+
fail-on-severity: moderate
52+
53+
codeql:
54+
name: CodeQL Analysis
55+
runs-on: ubuntu-latest
56+
permissions:
57+
actions: read
58+
contents: read
59+
security-events: write
60+
61+
strategy:
62+
fail-fast: false
63+
matrix:
64+
language: ['javascript', 'typescript']
65+
66+
steps:
67+
- uses: actions/checkout@v4
68+
69+
- name: Initialize CodeQL
70+
uses: github/codeql-action/init@v3
71+
with:
72+
languages: ${{ matrix.language }}
73+
queries: security-and-quality
74+
75+
- name: Autobuild
76+
uses: github/codeql-action/autobuild@v3
77+
78+
- name: Perform CodeQL Analysis
79+
uses: github/codeql-action/analyze@v3
80+
with:
81+
category: "/language:${{matrix.language}}"

‎CHANGELOG.md‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,40 @@
11
# Changelog
22

3-
## [Unreleased] - 2026-01-02
3+
## [Unreleased]
4+
### Changed
5+
- Placeholder for future changes
6+
7+
## [1.0.4] - 2026-01-14
8+
9+
### Security
10+
- **npm Trusted Publishing enabled** - packages published via OIDC (no tokens)
11+
- **Cryptographic provenance** - every release includes verifiable supply chain attestation
12+
- **Automated security audits** - weekly dependency vulnerability scanning via GitHub Actions
13+
- **Dependabot enabled** - automated dependency updates with grouped PRs
14+
- **CodeQL analysis** - continuous code security scanning
15+
- **React compatibility testing** - automated React 18 & 19 compatibility matrix
16+
- Zero known vulnerabilities (npm audit clean)
17+
18+
### Infrastructure
19+
- Migrated to npm Trusted Publishing (OIDC) from classic tokens
20+
- New tag-based release workflow (replaces auto-bump on push)
21+
- Automated release workflow with provenance generation
22+
- Supply chain verification via Sigstore transparency log
23+
- GitHub Releases automatically created from tags
24+
- Comprehensive security badge suite in README
25+
26+
### Documentation
27+
- Added SECURITY.md with vulnerability reporting process
28+
- Updated README with security badges (npm Audit, CodeQL, React compatibility, Provenance)
29+
- Fixed npm package name in badges (@crashbytes/react-version-compare)
30+
31+
**Verify Package Provenance:**
32+
```bash
33+
npm view @crashbytes/react-version-compare dist.integrity
34+
# Or visit: https://www.npmjs.com/package/@crashbytes/react-version-compare
35+
```
36+
37+
## [1.0.3] - 2026-01-02
438
### Added
539
- Comprehensive unit test suite with 80%+ coverage targeting
640
- GitHub Pages deployment for Storybook and test coverage

‎README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,14 @@
22

33
A React component for comparing strings and arrays with precise word-level and item-level highlighting of differences.
44

5-
[![npm version](https://badge.fury.io/js/react-version-compare.svg)](https://badge.fury.io/js/react-version-compare)
5+
[![npm version](https://badge.fury.io/js/%40crashbytes%2Freact-version-compare.svg)](https://www.npmjs.com/package/@crashbytes/react-version-compare)
6+
[![npm](https://img.shields.io/npm/v/@crashbytes/react-version-compare.svg)](https://www.npmjs.com/package/@crashbytes/react-version-compare)
67
[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
8+
[![npm Audit](https://github.com/CrashBytes/react-version-compare/actions/workflows/security-audit.yml/badge.svg)](https://github.com/CrashBytes/react-version-compare/actions/workflows/security-audit.yml)
9+
[![CodeQL](https://github.com/CrashBytes/react-version-compare/actions/workflows/security-audit.yml/badge.svg?branch=main)](https://github.com/CrashBytes/react-version-compare/security/code-scanning)
10+
[![React 18](https://github.com/CrashBytes/react-version-compare/actions/workflows/react-compat.yml/badge.svg)](https://github.com/CrashBytes/react-version-compare/actions/workflows/react-compat.yml)
11+
[![React 19](https://github.com/CrashBytes/react-version-compare/actions/workflows/react-compat.yml/badge.svg)](https://github.com/CrashBytes/react-version-compare/actions/workflows/react-compat.yml)
12+
[![npm Provenance](https://img.shields.io/badge/provenance-sigstore-blue)](https://www.npmjs.com/package/@crashbytes/react-version-compare)
713
[![Coverage](https://img.shields.io/badge/coverage-99.31%25-brightgreen.svg)](https://crashbytes.github.io/react-version-compare/coverage/)
814
[![Tests](https://img.shields.io/badge/tests-124%20passing-brightgreen.svg)](https://crashbytes.github.io/react-version-compare/coverage/)
915

‎SECURITY.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We release patches for security vulnerabilities for the following versions:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 1.x | :white_check_mark: |
10+
11+
## Reporting a Vulnerability
12+
13+
We take the security of `@crashbytes/react-version-compare` seriously. If you believe you have found a security vulnerability, please report it to us as described below.
14+
15+
**Please do not report security vulnerabilities through public GitHub issues.**
16+
17+
Instead, please report them via email to: **security@crashbytes.com**
18+
19+
You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
20+
21+
Please include the following information in your report:
22+
23+
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
24+
- Full paths of source file(s) related to the manifestation of the issue
25+
- The location of the affected source code (tag/branch/commit or direct URL)
26+
- Any special configuration required to reproduce the issue
27+
- Step-by-step instructions to reproduce the issue
28+
- Proof-of-concept or exploit code (if possible)
29+
- Impact of the issue, including how an attacker might exploit it
30+
31+
This information will help us triage your report more quickly.
32+
33+
## Preferred Languages
34+
35+
We prefer all communications to be in English.
36+
37+
## Security Update Process
38+
39+
When we receive a security bug report, we will:
40+
41+
1. Confirm the problem and determine affected versions
42+
2. Audit code to find any similar problems
43+
3. Prepare fixes for all supported versions
44+
4. Release new security patch versions as soon as possible
45+
46+
## Comments on This Policy
47+
48+
If you have suggestions on how this process could be improved, please submit a pull request.

0 commit comments

Comments
 (0)